Uploaded image for project: 'Accumulo'
  1. Accumulo
  2. ACCUMULO-1242 Consistent logging
  3. ACCUMULO-3681

Avoid string format injection problems

    XMLWordPrintableJSON

Details

    • Sub-task
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • 1.7.0
    • build
    • None

    Description

      In log4j, we could write log.debug(e,e);, where e was an Exception type, whenever we didn't have a more specific message to put in. Log4j would convert the first parameter to a String.

      With the migration to slf4j, this no longer works. Instead, slf4j requires the first parameter to be a format string. So, in many places, we've converted these to something like log.debug(e.toString(),e);.

      However, the key point here is that it's not just any string, it's specifically a format string. So, this will be problematic if e.toString() actually contains format instructions like The input "{}" is not a valid table name.

      To avoid these kinds of problems, we should take care to replace these with a better option:

      1. log.debug("Some explicit message", e); (preferred)
      2. log.debug("", e);
      3. log.debug("{}", e.getMessage(), e);
      4. log.debug("{}", e.toString(), e);
      5. log.debug("{}", e, e);

      Attachments

        Issue Links

          Activity

            People

              etcoleman Ed Coleman
              ctubbsii Christopher Tubbs
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 20m
                  20m